diff --git a/roles/init/tasks/mgmtuser.yml b/roles/init/tasks/mgmtuser.yml index ce7edd5..f087646 100644 --- a/roles/init/tasks/mgmtuser.yml +++ b/roles/init/tasks/mgmtuser.yml @@ -3,21 +3,8 @@ - name: Creazione account di gestione Ansible user: name=amgmt comment="Ansible Management User" group=wheel state=present password=$6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k. -- name: Creo copia di backup di sudoers - shell: test -f {{ item }} || cp -fv /etc/sudoers {{ item }} - with_items: - - /etc/sudoers.bak - - /etc/sudoers.tmp - register: copylog - changed_when: "'/etc/sudoers' in copylog.stdout" - - name: Concessione diritti all'utente di gestione Ansible - lineinfile: dest=/etc/sudoers.tmp regexp="^amgmt.*NOPASSWD" line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" state=present - register: sudotmp - -- name: Applicazione diritti utente Ansible - shell: visudo -q -c -f /etc/sudoers.tmp && cp -f /etc/sudoers.tmp /etc/sudoers - when: sudotmp|changed + template: src=sudoers.d dest=/etc/sudoers.d/amgmt mode="u=r,g=r" validate="visudo -cf %s" - name: Installazione chiave privata PC locale authorized_key: user=amgmt key="{{ lookup('file', admin_sshkey) }}" state=present diff --git a/roles/init/templates/sudoers.d b/roles/init/templates/sudoers.d new file mode 100644 index 0000000..ea85220 --- /dev/null +++ b/roles/init/templates/sudoers.d @@ -0,0 +1,3 @@ +# {{ ansible_managed }} +# Autorizzazione di gestione per l'utente di ansible +amgmt ALL=(ALL:ALL) NOPASSWD:ALL